A threat intelligence platform collects reports of malicious infrastructure, files, and techniques, then turns them into a feed a defender can use. It stores the indicators, scores them, and pushes the ones that matter into the tools that block or investigate.
Those tools are often a Security Orchestration, Automation, and Response (SOAR) workflow. The platform supplies the indicators. The workflow decides which playbook runs when one of them is seen.
What the Platform Keeps
- Indicators. Addresses, hashes, and names tied to an intrusion.
- Context. Which incident the indicator came from and how old it is.
- A feed. A subset pushed to a firewall, a mailbox filter, or a response workflow.
The Library and the Response Workflow
| Compared | The Platform | The Response Workflow |
| Holds the indicators | Yes | Receives the ones it was sent |
| Runs a playbook | No | Yes |
| A stale indicator | Ages it out of the feed | Stops acting on it once the feed drops it |
